Skip to content

Commit

Permalink
Sentinel rebranding (Azure#119)
Browse files Browse the repository at this point in the history
  • Loading branch information
zhzhao8888 authored Nov 3, 2021
1 parent daf4b19 commit b0f7195
Show file tree
Hide file tree
Showing 68 changed files with 7,779 additions and 7,583 deletions.
1,160 changes: 580 additions & 580 deletions A Getting Started Guide For Azure Sentinel ML Notebooks.ipynb

Large diffs are not rendered by default.

326 changes: 163 additions & 163 deletions A Getting Started Guide For Azure Sentinel Notebooks.ipynb

Large diffs are not rendered by default.

199 changes: 198 additions & 1 deletion A Getting Started Guide For CSharp AML Notebooks.ipynb

Large diffs are not rendered by default.

32 changes: 16 additions & 16 deletions A Getting Started Guide For PowerShell AML Notebooks.ipynb
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@
}
},
"source": [
"# A Getting Started Guide for Azure Sentinel notebooks with PowerShell\r\n",
"# A Getting Started Guide for Microsoft Sentinel notebooks with PowerShell\r\n",
"**Notebook Version:** 2.0<br>\r\n",
"\r\n",
"**Data Sources Required**:\r\n",
Expand All @@ -20,15 +20,15 @@
" - To use this notebook, you will first need to install .Net Interactive. \r\n",
" Please follow the instructions in the section of \"Installing the required PowerShell modules\". \r\n",
" Current Ubuntu version is 18.04, and .NET SDK 5.0 is required.\r\n",
" Details can be found in this article -> [Azure Sentinel Notebooks + Powershell](https://aka.ms/sentinel/pwsh-notebooks).\r\n",
" Details can be found in this article -> [Microsoft Sentinel Notebooks + Powershell](https://aka.ms/sentinel/pwsh-notebooks).\r\n",
"\r\n",
"** About this notebook **: \r\n",
"\r\n",
"This notebook takes you through the basics needed to get started with PowerShell notebooks that leverage Azure Sentinel data and APIs. \r\n",
"This notebook takes you through the basics needed to get started with PowerShell notebooks that leverage Microsoft Sentinel data and APIs. \r\n",
"\r\n",
"This notebook assumes that you are running this in an Azure Machine Learning notebooks environment created via the Azure Sentinel UI as this notebook has not yet been tested in other environments. Check the [official documentation](https://docs.microsoft.com/en-us/azure/sentinel/notebooks) on creating an Azure Sentinel AML workspace/environment to learn more.\r\n",
"This notebook assumes that you are running this in an Azure Machine Learning notebooks environment created via the Microsoft Sentinel UI as this notebook has not yet been tested in other environments. Check the [official documentation](https://docs.microsoft.com/en-us/azure/sentinel/notebooks) on creating a Microsoft Sentinel AML workspace/environment to learn more.\r\n",
"\r\n",
"For a notebook that provides more definitive guidance to the notebook experience, launch the [A Getting Started Guide for Azure Sentinel ML Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb) notebook from the Azure Sentinel notebook UI. This notebook provides a step-by-step overview of the notebook experience as well as some tips and tricks on how to get the most out of your Jupyter notebook experience.\r\n",
"For a notebook that provides more definitive guidance to the notebook experience, launch the [A Getting Started Guide for Microsoft Sentinel ML Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb) notebook from the Microsoft Sentinel notebook UI. This notebook provides a step-by-step overview of the notebook experience as well as some tips and tricks on how to get the most out of your Jupyter notebook experience.\r\n",
"\r\n",
"For more information as to why Juypter for security investigations, check out this excellent article [Why Use Jupyter for Security Investigations](https://techcommunity.microsoft.com/t5/azure-sentinel/why-use-jupyter-for-security-investigations/ba-p/475729)\r\n",
"\r\n",
Expand Down Expand Up @@ -636,9 +636,9 @@
},
"source": [
"---\r\n",
"## Azure Sentinel Configuration\r\n",
"Once we have set up our Jupyter environment with the libraries that we'll use in the notebook, we need to make sure we have some configuration in place. Some of the notebook components need addtional configuration to connect to external services (e.g. API keys to retrieve Threat Intelligence data). This includes configuration for connection to our Azure Sentinel workspace.\r\n",
"For this notebook, we simply import the configuration from the config.json file that is created in your notebook explorer folder when you launch the notebook from the Azure Sentinel UI.\r\n",
"## Microsoft Sentinel Configuration\r\n",
"Once we have set up our Jupyter environment with the libraries that we'll use in the notebook, we need to make sure we have some configuration in place. Some of the notebook components need addtional configuration to connect to external services (e.g. API keys to retrieve Threat Intelligence data). This includes configuration for connection to our Microsoft Sentinel workspace.\r\n",
"For this notebook, we simply import the configuration from the config.json file that is created in your notebook explorer folder when you launch the notebook from the Microsoft Sentinel UI.\r\n",
"<br>\r\n"
]
},
Expand Down Expand Up @@ -710,7 +710,7 @@
},
"source": [
"---\r\n",
"## Connect to your Azure Sentinel workspace\r\n",
"## Connect to your Microsoft Sentinel workspace\r\n",
"Once you have configured your notebook, now you can connect to your workspace.\r\n",
"\r\n",
"> **Note**: <br>\r\n",
Expand Down Expand Up @@ -839,8 +839,8 @@
},
"source": [
"---\r\n",
"## Access your Azure Sentinel incidents \r\n",
"Utilize the Azure Sentinel API to download metadata regarding your incidents\r\n",
"## Access your Microsoft Sentinel incidents \r\n",
"Utilize the Microsoft Sentinel API to download metadata regarding your incidents\r\n",
"\r\n",
"> **Note**: It could take a few seconds to download all of your incidents!\r\n",
"<br>\r\n",
Expand Down Expand Up @@ -988,12 +988,12 @@
},
"source": [
"---\r\n",
"## Query your Azure Sentinel Data\r\n",
"Data within your Azure Sentinel workspace can be manipulated.\r\n",
"## Query your Microsoft Sentinel Data\r\n",
"Data within your Microsoft Sentinel workspace can be manipulated.\r\n",
"My favorite part about working with notebooks is that I can extract values from one query or API call and use them as inputs to another query and/or API.\r\n",
"\r\n",
"> **Note**: \r\n",
"- The query below requires the Heartbeat table. This was chosen as an example since it will reside in all Azure Sentinel workspaces.\r\n",
"- The query below requires the Heartbeat table. This was chosen as an example since it will reside in all Microsoft Sentinel workspaces.\r\n",
"- For a more 'real world' example, pick another table or add your own query.\r\n",
"<br>\r\n",
"<br>"
Expand Down Expand Up @@ -1052,7 +1052,7 @@
},
"source": [
"---\r\n",
"## Match Azure Sentinel data with IOCs\r\n",
"## Match Microsoft Sentinel data with IOCs\r\n",
"You can also join data from external sources...\r\n",
"\r\n",
"<br>\r\n",
Expand Down Expand Up @@ -1123,7 +1123,7 @@
"- For this we are going to use an external threat intelligence provider to give us some more details about a URL.\r\n",
"- The example cell below assuming you have a VirusTotal (VT) key in your yaml configuration file\r\n",
"- If you don't already have a VirusTotal API key, signup [here](https://www.virustotal.com/gui/join-us).\r\n",
"- If not, you can either hardcode the VT key in the cell or run the [A Getting Started Guide for Azure Sentinel ML Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb) notebook for instructions on how to create the configuration file with your VirusTotal key included. \r\n",
"- If not, you can either hardcode the VT key in the cell or run the [A Getting Started Guide for Microsoft Sentinel ML Notebooks](https://github.com/Azure/Azure-Sentinel-Notebooks/blob/master/A%20Getting%20Started%20Guide%20For%20Azure%20Sentinel%20ML%20Notebooks.ipynb) notebook for instructions on how to create the configuration file with your VirusTotal key included. \r\n",
"<br/>"
]
},
Expand Down
4 changes: 2 additions & 2 deletions A Python Crash Course - Part 1 - Fundamentals.ipynb
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
"source": [
"# Getting Started\n",
"\n",
"If you haven't already, you may want to understand how to use Jupyter notebooks and more specifically Azure Notebooks by using this guide \"Getting Started with Azure ML Notebooks and Azure Sentinel\"\n",
"If you haven't already, you may want to understand how to use Jupyter notebooks and more specifically Azure Notebooks by using this guide \"Getting Started with Azure ML Notebooks and Microsoft Sentinel\"\n",
"\n",
"[![docs](https://img.shields.io/badge/docs.microsoft.com_-_Getting_Started_with_Azure_notebooks-lightgrey?logo=microsoft&style=social)](https://docs.microsoft.com/en-us/azure/sentinel/notebook-get-started)\n",
"<br><br>\n",
Expand Down Expand Up @@ -586,7 +586,7 @@
"print(s1,s2)\n",
"```\n",
"![Exercise](https://img.shields.io/badge/Exercise-blueviolet)\n",
"How would you print `Azure Sentinel` using what you know?"
"How would you print `Microsoft Sentinel` using what you know?"
],
"metadata": {
"nteract": {
Expand Down
Loading

0 comments on commit b0f7195

Please sign in to comment.